CVE-2025-1828

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-1828
Crypt::Random Perl package 1.05 through 1.55 may use rand() function, which is not cryptographically strong, for cryptographic functions. If the Provider is not specified and /dev/urandom or an Entropy Gathering Daemon (egd) service is not available Crypt::Random will default to use the insecure Crypt::Random::rand provider. In particular, Windows versions of perl will encounter this issue by default.
CVSS

No CVSS.

References
Link Resource
https://github.com/perl-Crypt-OpenPGP/Crypt-Random/commit/1f8b29e9e89d8d083fd025152e76ec918136cc05 Patch
https://github.com/perl-Crypt-OpenPGP/Crypt-Random/pull/1 Issue Tracking Patch
https://perldoc.perl.org/functions/rand Patch
Configurations

Configuration 1 (hide)

cpe:2.3:a:timlegge:crypt\:\:random:*:*:*:*:*:perl:*:*
History

27 Jun 2025, 16:11

Type Values Removed Values Added
First Time Timlegge
Timlegge crypt\
CPE cpe:2.3:a:timlegge:crypt\:\:random:*:*:*:*:*:perl:*:*
References () https://perldoc.perl.org/functions/rand - () https://perldoc.perl.org/functions/rand - Patch
References () https://github.com/perl-Crypt-OpenPGP/Crypt-Random/pull/1 - () https://github.com/perl-Crypt-OpenPGP/Crypt-Random/pull/1 - Issue Tracking, Patch
References () https://github.com/perl-Crypt-OpenPGP/Crypt-Random/commit/1f8b29e9e89d8d083fd025152e76ec918136cc05 - () https://github.com/perl-Crypt-OpenPGP/Crypt-Random/commit/1f8b29e9e89d8d083fd025152e76ec918136cc05 - Patch

26 Mar 2025, 02:15

Type Values Removed Values Added
Summary Crypt::Random Perl package 1.05 through 1.55 may use rand() function, which is not cryptographically strong, for cryptographic functions. Crypt::Random::rand 1.05 through 1.55 uses the rand() function. If the Provider is not specified and /dev/urandom or an Entropy Gathering Daemon (egd) service is not available Crypt::Random will default to use the insecure Crypt::Random::rand provider. In particular, Windows versions of perl will encounter this issue by default. Crypt::Random Perl package 1.05 through 1.55 may use rand() function, which is not cryptographically strong, for cryptographic functions. If the Provider is not specified and /dev/urandom or an Entropy Gathering Daemon (egd) service is not available Crypt::Random will default to use the insecure Crypt::Random::rand provider. In particular, Windows versions of perl will encounter this issue by default.

11 Mar 2025, 03:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-03-11 00:15

Updated : 2025-06-27 16:11

NVD link : CVE-2025-1828

Mitre link : CVE-2025-1828

JSON object : View

Products Affected

timlegge

  • crypt\
CWE

No CWE.